# CyberPanel alternative: 6 options and how to migrate safely

> Looking for a CyberPanel alternative? Compare HestiaCP, CloudPanel, aaPanel, Virtualmin, DirectAdmin and ZoPanel, then move sites, databases and email.

Source: https://zopanel.net/blog/cyberpanel-alternative  
Updated: 2026-10-09

## Key takeaways

- CyberPanel is free and runs OpenLiteSpeed with mail and DNS, but its October 2024 security incident led many users to reconsider.
- Choose a replacement by web server, built-in mail, account isolation and pricing model.
- The LiteSpeed Cache plugin's server-level page cache does not work on nginx, so use the new panel's page cache.
- A migration has four parts: files, databases, email and DNS; lower DNS TTL a day before.

If you want a CyberPanel alternative, the options most worth considering in 2026 are HestiaCP and CloudPanel (free), aaPanel (freemium), Virtualmin (GPL), DirectAdmin (paid and lightweight) and ZoPanel (licensed per server, with a Free plan). Which one fits depends on whether you need email on the same server, whether you sell hosting to customers, and how much you care about isolation between sites.

This article explains why people are moving off CyberPanel, compares the alternatives on concrete criteria, and then walks through moving a WordPress site, its database, email and DNS, including the parts people often miss, such as the LiteSpeed Cache plugin.

## What CyberPanel does well, and why people look elsewhere

To be fair, CyberPanel has real strengths. According to its [GitHub repository](https://github.com/usmannasir/cyberpanel), it is open source (GPL-3.0), runs on OpenLiteSpeed, includes email, DNS (PowerDNS) and Docker management, and installs on Ubuntu and AlmaLinux. For WordPress sites using the LiteSpeed Cache plugin, OpenLiteSpeed gives good performance without a license fee.

The common reasons people look for a CyberPanel alternative:

- **The October 2024 security incident.** Flaws in CyberPanel 2.3.6 and 2.3.7 (including CVE-2024-51567, rated CVSS 10) let unauthenticated attackers run commands as root. As [Help Net Security reported](https://www.helpnetsecurity.com/2024/10/30/vulnerable-cyberpanel-psaux-ransomware/), LeakIX counted about 21,761 vulnerable CyberPanel instances exposed online, and they were mass-exploited to install PSAUX ransomware. CyberPanel released fixes, but the incident made many administrators rethink the security architecture of their panel.
- **Preferring nginx** over OpenLiteSpeed, because the team already knows nginx configuration.
- **Needing hosting-business features:** resellers, packages, per-account resource limits, WHMCS integration.
- **Wanting Debian**, which CyberPanel lists only under third-party support, without guaranteed compatibility.

Vulnerabilities can happen in any software, including the panel we make. The real lesson is the question **what happens when the panel has a bug?** If the web interface runs as root, one command injection means losing the whole server. That is why we wrote [why a hosting control panel should never run as root](/blog/secure-hosting-panel-architecture).

## How to choose a CyberPanel alternative

| Criterion | Question to answer |
| --- | --- |
| Web server | nginx, Apache, or stay with LiteSpeed? Do sites depend on `.htaccess`? |
| Email | Mail server on the same VPS, or Google Workspace, Microsoft 365, Zoho? |
| Security | Does the web interface run as root? 2FA, a panel IP allowlist? |
| Isolation | Does each site get its own user, PHP pool and CPU/memory limits? |
| Applications | Do you need Node.js, Python, Docker? |
| Pricing | Free, per server or per account? |
| OS | Ubuntu, Debian or AlmaLinux? |

## Six CyberPanel alternatives compared

| Panel | Web server | Email | Price (October 2026) | Good for |
| --- | --- | --- | --- | --- |
| HestiaCP | nginx + Apache | Yes | Free (GPLv3) | Hands-on admins, small hosting |
| CloudPanel | nginx | No | Free | Your own PHP, Node.js, Python sites |
| aaPanel | nginx or Apache | Via its Mail Server app | Free; Pro $198/year | Users who like a one-click app catalogue |
| Virtualmin | Apache or nginx | Yes | GPL free; Pro paid | Webmin users |
| DirectAdmin | Apache/nginx/LiteSpeed | Yes | From $5/month; Standard $29/month | Hosts wanting a lean commercial panel |
| ZoPanel | nginx (optional Apache for `.htaccess`) | Yes | Free; Pro $49/year | Hosting and agencies on Ubuntu/Debian |

All prices are at the time of writing; check each vendor's pricing page. For a wider comparison, see [the best VPS control panels in 2026](/blog/best-vps-control-panel-2026).

**HestiaCP** is closest to CyberPanel in spirit: free, open source, with web, mail and DNS. **CloudPanel** is light and fast but has no mail server. **aaPanel** is approachable, with many one-click apps. **Virtualmin** is extremely flexible, with a busy interface. **DirectAdmin** is a long-standing, stable commercial panel with tiered pricing.

**ZoPanel** differs in architecture: the web interface runs as an unprivileged user, and anything that needs root goes through a separate agent that accepts only a fixed list of actions and re-checks every parameter. Each hosting account runs in its own systemd sandbox with CPU, memory and process limits. A web application firewall, malware scanning, two-factor authentication and a panel IP allowlist are included ([security docs](/docs/security)). Limits to know: it runs only on Ubuntu 22.04/24.04 and Debian 12/13, needs a fresh server, and **does not import CyberPanel backups directly** (it imports cPanel and DirectAdmin backups), so you move sites by hand as shown below.

## Before you migrate: inventory and preparation

1. **List** every website, database, mailbox, DNS record and cron job on CyberPanel.
2. **Lower the TTL** on A and MX records to 300 seconds at least 24 hours before the move.
3. **Create a new VPS** and install the target panel there. Never install a new panel over a running CyberPanel server.
4. **Protect the old server** during the move: update CyberPanel to the latest release and restrict its admin port (8090) to your own IP.

## How to move from CyberPanel to ZoPanel step by step

### Step 1: Install ZoPanel on the new VPS

```bash
curl -fsSL https://get.zopanel.net | sudo bash
```

Sign in at `https://SERVER-IP:8888` and turn on two-factor authentication. If you need email, install the mail server from the **Email** page (see the [email docs](/docs/email)).

### Step 2: Package files and the database on the CyberPanel server

On CyberPanel, a site usually lives in `/home/example.com/public_html`. SSH into the old server:

```bash
cd /home/example.com
tar -czf /root/example-files.tar.gz public_html
mysqldump --single-transaction your_database | gzip > /root/example-db.sql.gz
```

Find the database name in `wp-config.php` (the `DB_NAME` line). If `mysqldump` is denied, use the site's database user with `-u` and `-p`.

### Step 3: Create the website and database in ZoPanel

1. Go to **Websites → New website**, enter the domain, choose the **PHP** type (not WordPress, since you will bring your own files) and pick the same PHP version as the old server.
2. Under **Databases**, click **New database**. Names always carry the account prefix, for example `alice_shop`, and the database user has the same name. Note the password.

### Step 4: Upload the data

- **Files:** open the **File Manager**, go to `domains/example.com/public_html`, upload `example-files.tar.gz` and click **Extract**. For large sites, use SFTP or rsync over SFTP ([FTP and SFTP](/docs/ftp-sftp)).
- **Database:** use **Import / restore** on the database to load the `.sql.gz` file.
- Edit `wp-config.php`: update `DB_NAME`, `DB_USER` and `DB_PASSWORD` for the new database, and keep `DB_HOST` as `localhost`.

### Step 5: Deal with LiteSpeed Cache and .htaccess

This is the step people forget. As the [plugin's WordPress.org page](https://wordpress.org/plugins/litespeed-cache/) explains, LiteSpeed Cache's server-level page cache needs OpenLiteSpeed, a commercial LiteSpeed product or QUIC.cloud. On nginx that part no longer does anything. So:

- turn off the plugin's page cache (or remove the plugin if caching was all you used it for);
- turn on **Page cache** on the website's **PHP & config** tab in ZoPanel. It skips logged-in users, carts and checkout pages, and purges automatically when you edit content.

If the site relies on its own `.htaccess` rules (rewrites, access rules), turn on **.htaccess support (Apache mode)** on the **Tools** tab. Note that page cache is off in Apache mode ([website docs](/docs/hosting)).

### Step 6: Move email

1. In ZoPanel, **Enable email for a domain** and recreate each mailbox.
2. Copy existing mail over IMAP: drag it between accounts in a mail client such as Thunderbird or Outlook, or use an IMAP sync tool such as imapsync for many mailboxes.
3. Publish the MX, SPF, DKIM and DMARC records from the **DNS records** card, then click **Run check** in **Mail delivery check**.

### Step 7: Test, then switch DNS

Before switching DNS, test the site on the new server by pointing the domain to the new IP in your computer's `hosts` file. When everything works, change the A record (and MX if mail moves too) to the new IP. A Let's Encrypt certificate is issued automatically as soon as the domain resolves to the new server ([SSL](/docs/ssl)). Keep the old server running for a few days to catch mail still following old DNS.

For more on moving with no visible downtime, see [how to migrate a website without downtime](/blog/migrate-website-without-downtime).

## If you stay on CyberPanel

Not everyone needs to move right away. If you keep CyberPanel, at least:

- keep it updated to the latest release;
- restrict the admin port 8090 to your own IP with the firewall;
- turn on two-factor authentication;
- back up off the server and test a restore regularly.

These measures apply to **every** control panel, ZoPanel included.

## Conclusion

There is no single CyberPanel alternative for everyone. HestiaCP is closest to its free, all-in-one approach, CloudPanel suits you if email lives elsewhere, DirectAdmin if you want a long-established commercial panel, and ZoPanel if you value privilege separation, account isolation and per-server licensing. Whichever you choose, move a few real sites to a test VPS first.

[ZoPanel's Free plan](/pricing) covers 3 hosting accounts, 10 websites and 10 databases with no time limit, enough to migrate part of your CyberPanel sites and compare.

## Frequently asked questions

### Is there a free alternative to CyberPanel?

Yes. HestiaCP (open source, with mail and DNS), CloudPanel (free, no mail server), aaPanel Free, Virtualmin GPL and ZoPanel's Free plan (10 websites, 10 databases) all cost nothing. Each has its own limits, so test before you switch.

### Is CyberPanel still safe to use?

The 2024 vulnerabilities were fixed in later releases. If you keep using it, stay updated, restrict the admin port 8090 to trusted IPs and enable two-factor authentication, as you should with any control panel.

### Can ZoPanel import CyberPanel backups?

No. ZoPanel imports cPanel and DirectAdmin backups directly. From CyberPanel you move things by hand: website files, database dumps, mail over IMAP and DNS records, following the steps above.

### Does the LiteSpeed Cache plugin work on nginx?

The plugin runs, but its server-level page cache only works with LiteSpeed or OpenLiteSpeed, or through QUIC.cloud. On nginx, turn off the plugin's page cache and use the panel's page cache instead.

### How long does a migration from CyberPanel take?

For a WordPress site of a few gigabytes, packaging, uploading, importing the database and testing usually takes a few hours. The slow parts are moving email and waiting for DNS, so lower the TTL a day ahead.